Fix for authenticated remote code execution through layout update

높음 8.8CVE-2021-41144 · GHSA-5j2g-3ph4-rgvm · Published 27/01/2023 · updated 17/06/2026

요약

CVE-2021-41144은(는) openmage/magento-lts, magento (openmage)에 영향을 주는 높음 (CVSS 8.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.2%, 전체 취약점의 67.3%보다 높음.
조치: 20.0.19, 19.4.22 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
openmage/magento-lts Packagist	`≥ 20.0.0, < 20.0.19< 19.4.22`	`20.0.1919.4.22`
magento openmage	`≥ 20.0.0, < 20.0.19< 19.4.22`	`20.0.1919.4.22`

Description

Impact

A layout block was able to bypass the block blacklist to execute remote code.

NVD description

OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, a layout block was able to bypass the block blacklist to execute remote code. Versions 19.4.22 and 20.0.19 contain a patch for this issue.

References

OpenMage/magento-lts security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-41144 · ADVISORY
OpenMage/magento-lts commit 06c4594 · WEB
OpenMage/magento-lts · PACKAGE
OpenMage/magento-lts release v19.4.22 · WEB
OpenMage/magento-lts release v20.0.19 · WEB

openmage/magento-lts의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

openmage/magento-lts

Packagist

≥ 20.0.0, < 20.0.19< 19.4.22

20.0.1919.4.22

magento

openmage

≥ 20.0.0, < 20.0.19< 19.4.22

20.0.1919.4.22

Description

Impact

A layout block was able to bypass the block blacklist to execute remote code.

NVD description

openmage/magento-lts의 다른 취약점

모두 보기 →